Ubuntu 22.04 LTS / 24.04 LTS / 25.10 : libpng vulnerabilities (USN-8251-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8251-1 advisory. It was discovered that libpng incorrectly handled memory when processing certain PNG files. If a user or automated system were tricke...

Bidders can bid at previous auction reserve price by frontrunning the setter transactions

Lines of code Vulnerability details Impact The AuctionHouse.settleCurrentAndCreateNewAuction can frontrun the setter functions such as setCreatorRateBps, setMinCreatorRateBps, setEntropyRateBps, setTimeBuffer, setMinBidIncrementPercentage & setReservePrice. As soon as the current auction ends, an...

Requiring Timelock For Setter Functions

Lines of code Vulnerability details Vulnerability Details We noticed that the following owner-privileged setter functions can update important state variables without a time delay. 1. setExecutionDelegate function of the BlurExchange contract L215 - 222 in code snippet 1 2. setPolicyManager...

Once-off setter functions can be set multiple times

Lines of code Vulnerability details Impact The once-off setter functions don't use require to limit, resulting in multiple calls. Proof of Concept RewardsDistributor.sol // Once off event on contract initialize function setDepositoraddress depositor external requiremsg.sender == depositor;...

Missing validations in setter and setPhaseTimes() functions.

Lines of code Vulnerability details Impact Time variable validations daStartTime, mintlistStartTime, publicStartTime, claimsStartTime, selfRefundsStartTime are only done in setPhaseTimes and not even all validations. These validations should be performed: daStartTime block.timestamp...

Add a timelock to DiamondCutFacet

Lines of code Vulnerability details Impact To give more trust to users: functions that set key/critical variables should be put behind a timelock. Proof of Concept Tools Used Remix Recommended Mitigation Steps Add a timelock to setter functions of key/critical variables. --- The text was updated...

Add a timelock to functions that set key variables

Handle s1m0 Vulnerability details Impact Functions like setLeveragePercent and setLiquidationThresholdPercent for both IsolatedMarginTrading and CrossMarginTrading should be put behind a timelock because they would give more trust to users. Now the owner could call them whenever he wants and a...